Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-first persona-routing skill with a small local checker script and no evidence of network access, credential use, persistence, or destructive behavior.
Install this only if you want a Chinese-first expert-persona router. Be aware that its trigger words are broad and its guidance is advisory, especially for hardware, legal, medical, financial, or safety-sensitive topics where a qualified human should make final decisions.
Referenced artifact was not completely inspected
- **证据（Evidence）**：本包源文件 = `SKILL.md` / `README.md` / `AGENTS.md` / `llms.txt` / `agents/`（5 份能力位人设，标注推导来源）/ `scripts/route.py`；执行器 = `scripts/route.py`（`--chec
The usage description includes a Chinese-only instruction and presents the skill/persona in Chinese without indicating that users may choose another language. This creates a natural-language locale policy concern because the skill appears to mandate or default to a specific language without explicit opt-in or justification.
The skill declares broad trigger phrases such as general concepts around AI social interaction, hardware access, visualization, and long-term collaboration, which can cause unintended invocation during ordinary discussion rather than explicit user intent. In a routing skill, this increases the chance of misclassification, persona over-activation, and accidental delegation to derived expert roles the user did not request.
The file presents the skill name, capability, and primary descriptive content in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language context. This can violate a language/locale policy when a skill imposes a specific language by default without explicit opt-in or justification.
The display name, capability, and core descriptive content are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The file does not indicate that this is a region-specific skill or that users can choose another language, so it appears to violate the language/locale policy criterion.
The file presents the skill name, responsibilities, boundaries, and deliverables entirely in Chinese, with no indication that users may choose another language or locale. Under the policy for natural-language constraints, this is a locale/language restriction that is not explicitly optional or justified as region-specific.
Line L3 presents the skill description and invocation guidance in Chinese alongside the English name, indicating a language-specific experience without any statement that users may choose another language. This is a natural-language policy concern because it imposes a locale/language assumption rather than offering an explicit option.
This file contains natural-language instructions and operational output only in Chinese, including usage guidance and routing descriptions. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
I reviewed the natural-language content for a requirement that users or agents must operate in a specific language or locale without opt-in. The document contains bilingual text, but it does not mandate a single language or impose a locale restriction, so this should not be treated as a violation.
The visible skill name, title, and body content are written in Chinese, which implies a fixed language experience. The file does not indicate that users may choose another language or that the Chinese-only scope is intentional for a specific locale, which can conflict with language/locale choice expectations.